A pure hardware communication interface and authentication protocol for device identity authentication
By using a pure hardware communication interface and authentication protocol, the security risks of software-based device authentication are resolved. By employing root key signing and hardware encryption within the chip, a higher level of security for device authentication is achieved. It supports multiple bus types and enhances the communication security between the device and external master control devices.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- 陈立波
- Filing Date
- 2026-05-27
- Publication Date
- 2026-07-14
AI Technical Summary
The existing communication and authentication between the device and the external master control device are mainly achieved through software, which poses security risks, such as the software protocol being easily cracked, malicious code attacks, and the root key being easily read.
It adopts a pure hardware communication interface and authentication protocol, including a physical interface module and a protocol execution module. It uses a root key generated inside the chip for hardware signing. No software processor is involved in the entire process. It uses a serial bus and a dedicated communication frame format. The physical interface module serves as the only communication channel, supports multiple bus types, and includes a hardware encryption module.
It improves the security of communication and authentication, prevents the root key from being leaked, detects data errors, prevents unauthorized access, implements end-to-end hardware encryption, and enhances the security and compatibility of device identity authentication.
Abstract
Description
Technical Field
[0001] This application relates to the field of device communication and identity authentication technology, and in particular to a pure hardware communication interface and authentication protocol for device identity authentication. Background Technology
[0002] Currently, communication and authentication between the device and the external master control device are mainly implemented through software. Software-based communication and authentication schemes have the following problems: First, software protocols are easily cracked or tampered with, leading to the theft or forgery of communication data; second, the authentication process is controlled by a software processor, making it vulnerable to malicious code attacks; and third, the root key is usually stored in a read-write memory, making it easy to be illegally read.
[0003] Some existing technologies employ hardware encryption chips for authentication, but communication and protocol parsing are still handled by software processors, which poses security risks. Therefore, a more secure pure hardware communication interface and authentication protocol are needed. Summary of the Invention
[0004] The purpose of this application is to overcome the shortcomings of the prior art and provide a pure hardware communication interface and authentication protocol for device identity authentication.
[0005] To achieve the above objectives, this application adopts the following technical solution: A pure hardware communication interface and authentication protocol for device identity authentication, including a physical interface module and a protocol execution module; The physical interface module is electrically connected to the external host control device via a serial bus. The protocol execution module has a built-in dedicated communication frame format and challenge-response authentication protocol; The challenge-response authentication protocol uses a root key generated inside the chip to hardware sign the challenge number. The root key is only generated and used inside the chip and does not leave the chip. Both the physical interface module and the protocol execution module are pure hardware circuits, with no software processor involved in communication and authentication control throughout the entire process.
[0006] Furthermore, the serial bus can be any one of a serial peripheral interface, an internal integrated circuit bus, a universal asynchronous transceiver bus, a controller area network bus, or a universal serial bus.
[0007] Furthermore, the physical interface module serves as the sole communication channel between the security chip and the external master control device.
[0008] Furthermore, the communication frame format includes a frame header identifier, a command code, a data length field, a data payload, and a check field; the check field is any one of 8-bit Cyclic Redundancy Check (CRC), 16-bit CRC, or 32-bit CRC.
[0009] Furthermore, the frame header identifier is 1 byte and is fixed at 0xA5; the command code is 1 byte; and the data length field is 2 bytes.
[0010] Furthermore, the command code includes 0x01 identity reading, 0x02 challenge-response, and 0x03 log writing.
[0011] Furthermore, the challenge-response authentication protocol includes the following steps: The external master device sends a challenge request; The security chip generates a random challenge number and returns it. The external control device sends the challenge number to the certification platform; The authentication platform uses a pre-stored public key to sign the challenge number; The security chip verifies the signature result.
[0012] A pure hardware communication interface system for device authentication includes the aforementioned physical interface module and protocol execution module.
[0013] Furthermore, the system also includes a hardware encryption module for end-to-end hardware encryption of communication data.
[0014] A device, equipped with the aforementioned communication interface and authentication protocol, is used for identity authentication communication with a security chip. Beneficial effects
[0015] This application has the following beneficial effects: 1. Both the physical interface module and the protocol execution module are pure hardware circuits. No software processor is involved in the communication and authentication control throughout the entire process, which avoids the security risks caused by software vulnerabilities and improves the security of communication and authentication.
[0016] 2. The challenge-response authentication protocol uses a root key generated inside the chip to hardware sign the challenge number. The root key is only generated and used inside the chip and does not leave the chip, effectively preventing the root key from being read illegally.
[0017] 3. Supports multiple serial bus types, with good compatibility and applicability.
[0018] 4. It adopts a dedicated communication frame format, which includes a check field, and can effectively detect data errors and tampering during the communication process.
[0019] 5. The physical interface module serves as the sole communication channel between the security chip and the external main control device, effectively preventing unauthorized access.
[0020] 6. The hardware encryption module performs end-to-end hardware encryption on the communication data, further improving the security of the communication data. Detailed Implementation
[0021] The present application will now be described in detail with reference to specific embodiments.
[0022] This embodiment provides a pure hardware communication interface and authentication protocol for device authentication, including a physical interface module and a protocol execution module. All modules are implemented using pure hardware integrated circuits, with no software processor involved in the entire process.
[0023] The physical interface module uses a serial peripheral interface bus to be electrically connected to the external master control device, serving as the only communication channel between the security chip and the external master control device.
[0024] The protocol execution module incorporates a dedicated communication frame format and challenge-response authentication protocol. The communication frame format includes a 1-byte frame header identifier (fixed at 0xA5), a 1-byte command code, a 2-byte data length field, a variable-length data payload, and a 2-byte 16-bit cyclic redundancy check field. The command code includes 0x01 identity reading, 0x02 challenge-response, and 0x03 log writing.
[0025] The specific process of the challenge-response authentication protocol is as follows: 1. The external host device sends the 0x02 challenge-response command to the security chip.
[0026] 2. The protocol execution module of the security chip generates a 16-byte random challenge number and returns the challenge number to the external master control device.
[0027] 3. The external master device sends the challenge number to the remote authentication platform.
[0028] 4. The authentication platform uses the pre-stored public key corresponding to the root key of the security chip to sign the challenge number and returns the signing result to the external master control device.
[0029] 5. The external master device sends the signature result to the security chip.
[0030] 6. The protocol execution module of the security chip uses its internal root key to verify the signature result. If the verification passes, it returns a successful authentication response; if the verification fails, it returns a failed authentication response.
[0031] This embodiment also provides a pure hardware communication interface system for device authentication, including the aforementioned physical interface module, protocol execution module, and hardware encryption module. The hardware encryption module is used to perform end-to-end hardware encryption on all communication data, further improving the security of the communication data.
Claims
1. A pure hardware communication interface and authentication protocol for device authentication, characterized in that, Includes a physical interface module and a protocol execution module; The physical interface module is electrically connected to the external host control device via a serial bus. The protocol execution module has a built-in dedicated communication frame format and challenge-response authentication protocol; The challenge-response authentication protocol uses a root key generated inside the chip to hardware sign the challenge number. The root key is only generated and used inside the chip and does not leave the chip. Both the physical interface module and the protocol execution module are pure hardware circuits, with no software processor involved in communication and authentication control throughout the entire process.
2. The communication interface and authentication protocol according to claim 1, characterized in that, The serial bus can be any one of the following: serial peripheral interface, internal integrated circuit bus, universal asynchronous transceiver bus, controller area network bus, or universal serial bus.
3. The communication interface and authentication protocol according to claim 1, characterized in that, The physical interface module serves as the sole communication channel between the security chip and the external master control device.
4. The communication interface and authentication protocol according to claim 1, characterized in that, The communication frame format includes a frame header identifier, a command code, a data length field, a data payload, and a check field; the check field is any one of 8-bit cyclic redundancy check, 16-bit cyclic redundancy check, or 32-bit cyclic redundancy check.
5. The communication interface and authentication protocol according to claim 4, characterized in that, The frame header identifier is 1 byte and is fixed at 0xA5; the command code is 1 byte; and the data length field is 2 bytes.
6. The communication interface and authentication protocol according to claim 5, characterized in that, The command codes include 0x01 identity reading, 0x02 challenge-response, and 0x03 log writing.
7. The communication interface and authentication protocol according to claim 1, characterized in that, The challenge-response authentication protocol includes the following steps: The external master device sends a challenge request; The security chip generates a random challenge number and returns it. The external control device sends the challenge number to the certification platform; The authentication platform uses a pre-stored public key to sign the challenge number; The security chip verifies the signature result.
8. A pure hardware communication interface system for device authentication, characterized in that, It includes the physical interface module and protocol execution module as described in claim 1.
9. The system according to claim 8, characterized in that, The system also includes a hardware encryption module for end-to-end hardware encryption of communication data.
10. A device, characterized in that, The device is equipped with the communication interface and authentication protocol as described in any one of claims 1 to 9, and is used for identity authentication communication with the security chip.